Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/08/2026

[CVE-2026-50472] Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges loca…

Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48438] CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in…

CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48439] CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could…

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48440] ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary …

ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48442] CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Director…

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Arbitrary file system read. An attacker could leverage this vulnerability to gain unauthorized read access to files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction. Scope is chang…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48385] ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS …

ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48386] ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that coul…

ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-47299] Improper neutralization of special elements used in a command ('command injection') in Azure Monitor…

Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-42976] Missing authentication for critical function in Windows RPC API allows an authorized attacker to ele…

Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-34635] is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security f…

is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction. Scope is changed.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-25652] is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A…

is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-21273] is affected by an Improper Input Validation vulnerability that could result in privilege escalation.…

is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-21279] is affected by an Improper Input Validation vulnerability that could result in a Security feature by…

is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-20349] A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security App…

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.  This vulnerability is due to insufficient error checking when processin…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-73079] Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product s…

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts (ChatGPT/Codex OAuth, OpenAI platform keys, or an operator-configured base URL) that belong to the operator, not to the caller. The `POST /responses/*sub…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-67179] Genkit does not properly validate host request headers. Any host on the developer's network, and any…

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit action and read the result. Fixed on 2026-06-18.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-67180] Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to …

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-56721] CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure dir…

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action body in the UsersController. Attackers can send a PATCH request to the updated_ajax endpoint setting…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48495] TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes…

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded `workspaceId`, `typebotId`, `blockId`, and `redirectUrl` without cryptographic integrity protection or authorization checks. The callback route is authenticated, but it does not verify that the authenticated user has write access to th…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48766] TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a …

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled `baseUrl`. The vulnerable path decrypts the selected workspace credential, creates an OpenAI client with the secret in both `apiKey` and the explicit `api-key` header, an…

nvdaltovulnerabilidad CVSS 7.6 NVD